Incident in progress
Cyberattack: the right reflexes, right now
Ransomware, a hacked account, a fraudulent payment: the first few minutes count. Follow the steps for your situation and call us.
What is your situation?
Ransomware: your files have been encrypted
Signs: unreadable or renamed files, a ransom demand on screen, computers or servers locked.
- 1
Disconnect the affected machines from the network: unplug the cable and turn off Wi-Fi. Do not switch them off, so that evidence useful to the investigation is preserved.
- 2
Also disconnect any drives and backups that are still intact, to keep them safe.
- 3
Do not pay the ransom and do not contact the attackers: there is no guarantee that your data will be returned.
- 4
Note the time you discovered the attack, photograph the ransom message and delete nothing.
- 5
If you have cyber insurance, alert its assistance line (the number is on your policy): most policies require you to report quickly and may cover the cost of the response.
- 6
Call us, then report the incident to 17Cyber and file a police report.
Phishing: an employee has clicked a link or entered their password
Signs: a link opened in a suspicious email, credentials entered on a fake Microsoft page, contacts receiving strange emails from you.
- 1
Change the account password immediately, from another device that is not compromised.
- 2
Sign the account out of all open sessions and turn on multi-factor authentication if it is not already enabled.
- 3
Check the mailbox rules (automatic forwarding, deletions): attackers create them to stay hidden.
- 4
Warn your contacts if fraudulent emails have been sent from your address.
- 5
If you have cyber insurance, alert its assistance line (the number is on your policy): most policies require you to report quickly and may cover the cost of the response.
- 6
Call us: we analyse the sign-ins and the actions carried out on the account.
Payment fraud: money has been sent to a fake payee
Signs: a supplier's change of bank details received by email, an urgent request from a company director, a payment you do not recognise.
- 1
Call your bank immediately to ask for the funds to be blocked or recalled: every hour counts.
- 2
Keep all the emails and documents exchanged, without forwarding or deleting them.
- 3
File a report with the police or gendarmerie, with the supporting documents.
- 4
If you have cyber insurance, alert its assistance line (the number is on your policy): most policies require you to report quickly and may cover the cost of the response.
- 5
Call us: payment fraud often relies on a compromised mailbox, which needs to be secured.
Personal data breach
Signs: customer, patient or employee data viewed, copied or published without authorisation.
- 1
Identify the data involved and the number of people affected.
- 2
If the breach poses a risk to the people concerned, notify the CNIL (the French data protection authority) within 72 hours (Article 33 of the GDPR).
- 3
Depending on the severity, inform the people concerned.
- 4
If you have cyber insurance, alert its assistance line (the number is on your policy): most policies require you to report quickly and may cover the cost of the response.
- 5
Call us to contain the breach and document the incident.
Official resources (in French)
- 17Cyber: diagnosis and assistance for victims of cybercrime.
- Cybermalveillance.gouv.fr: advice and local service providers.
- CNIL: notification of a personal data breach.
Stop it happening again
Multi-factor authentication, offline backups, hardened and monitored devices: check your level of protection.
Take the cyber insurance checklistFrequently asked questions
Should we pay the ransom?
No. The French authorities advise never to pay: there is no guarantee that your data will be returned, and payment funds further attacks. Recovery relies on clean backups and rebuilding the affected systems.
Should we switch off an infected computer?
No. Isolate it from the network (cable unplugged, Wi-Fi turned off) but leave it on: its memory holds evidence that helps investigators understand the attack.
Who should we contact after a cyberattack?
Your IT provider first, then 17Cyber (17cyber.gouv.fr), the French national victim assistance service. File a police report, inform your insurer if you have cyber insurance, and the CNIL if personal data has been breached.
Does my cyber insurance cover the incident?
Inform your insurer as soon as possible: most policies set a deadline for reporting and give access to an assistance service. Keep all the evidence.